Computer Security Incident Response Team Essay

In the last decade, more and more companies have started to look into e-commerce to connect them to the infinite world of global suppliers, sparkners, consumers and untold more. This boom in technologarithmy has placed multiple assets are danger from a certificate stand point wholeowing hackers/crakers and anyone on the internet to recognise access to these network and gain information or try to take chances subscriber line to a point where it stand stills.Increase in defence mechanism of service attacks, child pornography, virus/worms and other tools used by individuals to set down data has lead to law enforcement and media to look into why and how these guarantor breaches are conducted and what new statutory laws are destinyed to stop this from happening. According to CSI calculator crime and security Survey 2007, the average annual discharge describe by security breach has shot up to $350,424 from 168,000 the previous year. To kick in to this, more and more organ izations are reporting computer intrusions to law enforcement which accustomed to 29 percent compared to 25 percent the year before. 1 To be roaring in respond to an adventure, there are a few things that need to be followed 1. Minimize the number of scratchiness of security accompanyings. 2. Assemble the marrow computer security Incident Response Team (CSIRT). 3. Define an ensuant rejoinder end. 4. Contain the damage and minimize risk. 3 How to minimize the number of severity and security incidents It is impossible to prevent all(a) security related incidents, and there are things that fire be make to minimize the electrical shock of such incidents Establishing and enforcing security policies and procedures. Gaining support from Management in twain enforcing security policies and manipulation incidents.Accessing vulnerabilities on the environment on lawful basis including regular audits. Checking all devices on certain time frames to make sure that all the updates were performed. Establishing security policies for both end users and security personal and asking for security clearance each and every time an access is granted. Posting banners and reminders for responsibilities and obstacle of use of applications, and other brasss on the network. Implementing secure password polices thought the network. Checking log files on regular basics and monitoring traffic. Verifying backups are done on regular basics and maintained in an appropriate manner. This would excessively include the new email backup policy laws. Create computing device Security Response Team (CSIRT) 3 Security threat is the same for both large, small, and government organizations and therefore it is valuable that regardless(prenominal) of what the company has for its security measures, it also has a written document that establishes guidelines for incident response. Incident respond be after is a set of guidelines that document on security incident handling and communicati on efforts.This plan is activated when an incident that could impact the companys ability to function is established. Computer Security Incident Response designing (CSIRP) should contain the following 1. Mission Things the response police squad will be responsible for, including how to handle incidents as they happen and what steps are essential to minimize the impact of such incidents. 2. Scope this would define, who is responsible for which area of security, it can include things like application, network(s), employees, communication both internally and to the public and a great deal more. . Information flow How information will be handled in example of an emergency and how it will be reported to the appropriate authority, pubic, media and internal employees. 4. work provided This document should contain all the services that are either provided to the users or services that are used or bought from other vendors including testing, education, service provider issues to name a few. 2 The CSIRT team must contain several members including a Team leader which will monitor changes in individuals actives and responsibility of reviewing actions.An Incident Lead, that will be dedicated as the owner of set of incidents and will be responsible for speaking to anyone outside the team while and corresponding changes and updates. A group of individuals part of the CISRT team called members will be responsible to handle responsibility of the incident and will monitor different areas of the company. Other members of this team should include sub judice help, public relations officers, contractors and other member of management both from business and IT that can help during security breaches.If an Incident has occurred, it is important to classify this as an incident severity. Most companies use between unfeelingness 1-5. 1 being the in high spiritsest and 5 being the research phase where no system or users are affected. For most system anything at a lower place Se verity 3 is not a major impact of the system plainly if there is a system wide issue that requires immediate attention, a severity 1 or 2 would fall under the kin of Incident response procedure and set up a high alert. The cost of an incident can be very high, depending on the loss of data, therefore identifying the risk and all the real threat fall under this category.Once the incident has been identified it should go into the assessment phase, where it should be unflinching if the system can be bought back up again and how some(prenominal) damage is done. If the business is impacted assessment should be done. The assessment includes rhetorical investigation usually involving a team of expert that look into the how umteen computer were affected, what kind of information was stolen or changed, entry level of attacks, potentiality damage done by incident, recovery process and the best way of life to assess this from happening again.The next phase of this is containment, which is the assessment of damage and isolation of other systems that can also be compromised including network. Backup of the system in the current state should be done at this time for further forensic investigation. Analyzing of log files and uncovering systems that were used like firewalls, routers should be identified. each modification of files including dos, exe should also be carried out in this phase. Once all this is done, the next step is Recovery. Recovery is restoring clean data back the system so it can perform is function as required.After facility last good backup, it is important to test the system before place this in production again. Further surveillance of network and application should be set in place as intruders might try this again. every company today, weather small or big needs an incident response unity to defend itself against predators on the web. The government agencies has set approximately rules and regulations on such standards and are required that company follow these standards to block further disruption of the service.This becomes even more critical for companies that play important place in the economy like credit card, health, insurance and much more. Several regional companies today can help plan CSIRP plan that provide help creating a team of individuals that can act spendthrift in such situations. The implementation of such plan cost less in the long run, when compared to companies that dont have such response plan and loose data that is critical to their survival.